Privacy Policy

RIADVICE SUARL (“RIADVICE”, “we”, “us” or “our”) respects the privacy of its customers, visitors and users. This Privacy Policy explains what personal data we collect when you visit our websites, contact us, become a customer, subscribe to our newsletter, use our applications or join one of our public platforms; why we collect it; who receives it; how long we keep it; and how you can exercise your rights.

This Policy uses the definitions of our Terms of Use. It is an information notice: it does not replace a data processing agreement signed with a Customer.

1. Who is responsible for your data

The controller of the processing described in this Policy is RIADVICE SUARL, a company incorporated in Tunisia, tax identification number 1310176H, with its registered office at Appartement B1, Résidence Ramzi, 2074 Mourouj 5, Ben Arous, Tunisia. For any question about your personal data, or to exercise your rights, write to privacy@riadvice.tn or contact@riadvice.com.

This Policy applies to all websites and services operated by RIADVICE that link to it. Shorter notices on other RIADVICE websites and in our applications refer back to it. A RIADVICE product or platform may have its own privacy notice; where it does, that notice applies to that product and this Policy applies to everything it does not address.

2. Our two roles: controller and processor

RIADVICE is controller for the data it processes for its own purposes: its websites, its sales and customer relationships, billing, support, its newsletter, its Public Platforms, and the technical operation of its Software. This Policy describes that processing.
RIADVICE is processor when it processes personal data on behalf of a Customer, for example the participants, recordings, chat messages and analytics of a BigBlueButton platform it hosts, the files in an application it operates for a Customer, or data it accesses while performing Professional Services. In that case the Customer (for example your school, university, training provider or employer) is the controller, decides why and how the data is processed, and is responsible for informing you. Please address your questions and requests to that Customer first. RIADVICE will help the Customer answer them, as our GDPR Compliance Statement explains.

3. Applicable law

RIADVICE is established in Tunisia and processes personal data in accordance with Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data, under the supervision of the Tunisian national authority for the protection of personal data (Instance Nationale de Protection des Données Personnelles, “INPDP”).

Because we offer our services to people and organisations in the European Union and the European Economic Area, the General Data Protection Regulation (EU) 2016/679 (“GDPR”) also applies to the processing of their data, under Article 3(2) GDPR. Where both apply, we follow the more protective rule.

4. What we collect, why, and on what basis

The table below lists each purpose, the data involved, and the legal basis under the GDPR. Section 8 explains how long we keep the data. Where Tunisian law applies, the same processing is carried out under the conditions of Organic Law No. 2004-63, including your consent where that law requires it.

Purpose	Personal data	Legal basis (GDPR)
Answering a message sent through the contact form	Name, email address, company or institution (optional), phone number (optional), subject, message, page language and time. For abuse prevention: a salted hash of your IP address (never the address itself) and your browser’s user agent.	Steps taken at your request before a contract (Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)).
Live chat and help desk tickets	What you write, your name and email address if you give them, the page you wrote from and the time.	Performance of a contract for customers (Art. 6(1)(b)); legitimate interest in answering requests (Art. 6(1)(f)).
Messages through WhatsApp or Telegram	Your messages, phone number or account name, and what you choose to share.	Legitimate interest in answering you through the channel you chose (Art. 6(1)(f)), or performance of a contract.
Newsletter	Email address, name (optional), the date of subscription and of confirmation, and unsubscribe events.	Consent, confirmed by a double opt-in email (Art. 6(1)(a)).
Customer accounts, the customer portal and contract management	Name, job title, organisation, email address, phone number, billing address, login data, order history and correspondence.	Performance of a contract (Art. 6(1)(b)).
Invoicing, accounting and tax	Invoices, payment records, tax and registration numbers, billing contacts.	Legal obligation (Art. 6(1)(c)).
Providing, supporting and securing the services we sell	Contact details of the Customer’s administrators and technical contacts, support history, technical logs.	Performance of a contract (Art. 6(1)(b)); legitimate interest in the security of our services (Art. 6(1)(f)).
Security and operation of our websites	Server logs (IP address, requested page, time, user agent), counters of form submissions keyed by a salted hash of the IP address, and the bot check on the contact form.	Legitimate interest in keeping our websites secure and available (Art. 6(1)(f)).
Measuring how our websites are used	Pages viewed, clicks on some buttons, approximate location, device and browser type, and Google Analytics identifiers.	Your consent (Art. 6(1)(a)), given in the cookie banner.
Technical operation of our Software	Technical data such as the IP address, application version, platform and the server being joined, for example when an application checks a licence or, where enabled, reports an error.	Performance of the licence (Art. 6(1)(b)); legitimate interest in protecting and fixing our Software (Art. 6(1)(f)).
Accounts and content on Public Platforms	Account data, profile, content you publish, reports and moderation decisions.	Performance of a contract (Art. 6(1)(b)); consent for optional features (Art. 6(1)(a)); legitimate interest in moderation and safety (Art. 6(1)(f)).
Business relationships with prospects, partners and suppliers	Name, organisation, role, contact details and exchanges.	Legitimate interest in developing and managing business relationships (Art. 6(1)(f)).
Compliance, fraud prevention and legal claims	The data relevant to the request, incident or dispute.	Legal obligation (Art. 6(1)(c)); legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f)).

When you send a message through the contact form, it is first stored on our own server so that it is not lost, then delivered by email to our team and to our internal messaging system, both operated by RIADVICE or by its hosting providers on its behalf. A copy of your message is emailed back to you as a receipt.

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object to such processing at any time, as Section 10 explains. Where we rely on consent, you can withdraw it at any time, without affecting processing carried out before the withdrawal.

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

You do not have to give us personal data. Without the data marked as required, however, we cannot answer an enquiry, open an account or provide a service.

5. Data we process for our Customers

When we host BigBlueButton or another application for a Customer, the personal data of its users is processed as part of that service: for example names and user identifiers, participation details, audio, video, chat messages, polls, shared files and screens, recordings, and the analytics and reports the Customer has ordered. We process this data only on the Customer’s instructions, as its processor. The Customer decides, among other things, whether sessions are recorded and how long recordings and data are kept. Our GDPR Compliance Statement describes our commitments as processor.

6. Who receives your data

We do not sell or rent your personal data. Within RIADVICE, only staff who need it for their work can access it, and they are bound by confidentiality. We share personal data only with:

hosting and infrastructure providers that host our websites and services, such as OVHcloud, and the other providers listed in our GDPR Compliance Statement;
Google, for website measurement, only after you have given consent;
Cloudflare, which provides the bot check on the contact form and receives your IP address and technical information about your browser while the check runs;
email delivery service providers, which transmit the emails we send;
banks and payment service providers, to process payments;
our accountants, auditors and legal advisers, under professional confidentiality;
public authorities, courts and law enforcement, where the law requires it or to protect our rights, the safety of users or to prevent fraud;
a purchaser or successor, if all or part of our business is transferred, under the same protections.

Some services are provided by independent controllers that you choose to use, such as WhatsApp, Telegram and application stores. They process your data under their own privacy policies.

Our help desk, newsletter system and internal messaging system are operated by RIADVICE itself, on infrastructure provided by our hosting providers.

Our service providers act on our instructions under contracts that require them to protect your data and to use it only for the services they provide to us.

7. International transfers

RIADVICE is established in Tunisia, which is not covered by an adequacy decision of the European Commission. Our main hosting infrastructure is located in France and elsewhere in the European Union. Personal data may nevertheless be accessed from Tunisia by RIADVICE staff, and some of our providers operate outside the European Union, for example in the United States.

When a Customer in the European Union or European Economic Area transfers personal data to RIADVICE as its processor, the transfer is covered by the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, in the module that matches the parties’ roles, together with the technical and organisational measures described in our GDPR Compliance Statement.
When we transfer personal data to a provider outside the European Union or European Economic Area, we use an adequacy decision where one exists (for example the EU-US Data Privacy Framework, for providers certified under it) or the Standard Contractual Clauses.
Transfers of personal data from Tunisia to other countries are made under the conditions of Organic Law No. 2004-63, including the authorisation of the INPDP where that law requires it.

You can obtain a copy of the safeguards that apply to a transfer by writing to privacy@riadvice.tn.

8. How long we keep data

We keep personal data for as long as it is needed for the purpose for which it was collected, as described in Section 4, or until you ask us to delete it. We honour every deletion request, whether it comes from a customer, a visitor or any other person whose data we hold.

The only exception is data that the law requires us to keep, such as invoices and accounting and tax records. We keep those records only for the period the law sets, and delete them afterwards.
When you leave our newsletter, we keep only your email address on a suppression list, so that we do not write to you again. You can ask us to remove it from that list too.
Counters used to limit abusive form submissions are kept only for the short window they cover.
The lifetimes of cookies are set out in our Cookie Policy.
Deleted data leaves our backups as they are overwritten in their normal rotation. It is not used in the meantime, except to restore a system.

9. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption of connections, encryption of confidential data, access restricted to authorised staff, authentication controls, regular updates and security patches, monitoring, backups and staff awareness of data protection. On our websites, we use a salted hash of the IP address, rather than the address itself, to limit abusive form submissions. No system connected to the internet is perfectly secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the competent authority within the time required by law and, where the risk is high, we inform you without undue delay.

10. Your rights

Under the GDPR, subject to its conditions, you have the right to:

access your personal data and obtain a copy of it;
have inaccurate or incomplete data rectified;
have your data erased;
restrict the processing of your data;
object to processing based on our legitimate interests, and object at any time to the use of your data for direct marketing;
receive the data you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller (data portability);
withdraw your consent at any time, where processing is based on consent;
lodge a complaint with a supervisory authority.

Under Tunisian Organic Law No. 2004-63, you also have the right to access your data, to have it rectified, completed, updated or deleted, and to object to its processing on legitimate grounds, including for direct marketing.

11. How to exercise your rights

Write to privacy@riadvice.tn or contact@riadvice.com, or by post to RIADVICE SUARL, Appartement B1, Résidence Ramzi, 2074 Mourouj 5, Ben Arous, Tunisia.
To withdraw consent to measurement cookies, use the “Cookie settings” link at the bottom of any page of the website. To leave the newsletter, use the unsubscribe link in any newsletter email.
We may ask you for information to confirm your identity before acting on a request, so that we do not disclose your data to someone else.
We answer within one month of receiving your request. This period may be extended by two further months for complex or numerous requests, in which case we tell you within the first month.
Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
If your request concerns data that we process for a Customer, we will forward it to that Customer and help it to answer.

12. Complaints

If you are not satisfied with our answer, or if you believe that the processing of your data breaches the law, you may lodge a complaint:

if you are in the European Union or European Economic Area, with the data protection supervisory authority of the Member State where you live, where you work or where the alleged infringement took place;
in Tunisia, with the Instance Nationale de Protection des Données Personnelles (INPDP), Tunis, www.inpdp.nat.tn.

We would appreciate the chance to address your concern first, so please contact us before you complain.

13. Children

Our websites and business services are not directed to children, and we do not knowingly collect personal data from children through them. The data of users of a hosted service, such as pupils taking part in online classes, is processed under the responsibility of the Customer that organises the service. Public Platforms set a minimum age in their terms. If you believe that we hold data about a child without a valid basis, contact us and we will delete it.

14. Cookies

Our Cookie Policy describes the cookies and similar technologies our website uses, and how to change your choices.

15. Links to other websites

Our websites contain links to websites and services operated by third parties. We are not responsible for their content or their privacy practices. Please read their privacy notices.

16. Changes to this Policy

We may update this Policy at any time to reflect changes in our services, our practices or the law. The updated Policy is published on this page and takes effect on the date shown at the end. Please review it regularly. By continuing to use our websites and services after an update, you acknowledge the updated Policy. Where the law requires us to inform you of a change or to obtain your consent, we will do so.

17. Contact

For any question about this Policy or your personal data: privacy@riadvice.tn or contact@riadvice.com. By post: RIADVICE SUARL, Appartement B1, Résidence Ramzi, 2074 Mourouj 5, Ben Arous, Tunisia.

Last updated: 10 October 2026